Warez Xenforo Upload Shell Açığı

<xen:title>{xen:phrase upload_attachments}</xen:title>

<form action="{xen:link 'attachments/do-upload'}" method="post" enctype="multipart/form-data" class="xenForm">
    
    <xen:if is="{$canUpload}">
        <dl class="ctrlUnit">
            <dt><label>{xen:phrase upload_attachments}:</label></dt>
            <dd><input type="file" name="upload" /></dd>
        </dl>
    </xen:if>
        
    <xen:if is="{$newAttachments}">
        <dl class="ctrlUnit">
            <dt><label>{xen:phrase new_attachments}:</label></dt>
            <dd>
                <ul>
                <xen:foreach loop="$newAttachments" value="$attachment">
                    <li>
                        <a href="{xen:link attachments, $attachment}">{$attachment.filename}</a>
                        <input type="submit" name="delete[{$attachment.attachment_id}]" value="{xen:phrase delete}" class="button" />
                    </li>
                </xen:foreach>
                </ul>
            </dd>
        </dl>
    </xen:if>

    <xen:if is="{$existingAttachments}">
        <dl class="ctrlUnit">
            <dt><label>{xen:phrase existing_attachments}:</label></dt>
            <dd>
                <ul>
                <xen:foreach loop="$existingAttachments" value="$attachment">
                    <li>
                        <a href="{xen:link attachments, $attachment}">{$attachment.filename}</a>
                        <input type="submit" name="delete[{$attachment.attachment_id}]" value="{xen:phrase delete}" class="button" />
                    </li>
                </xen:foreach>
                </ul>
            </dd>
        </dl>
    </xen:if>

    <dl class="ctrlUnit submitUnit">
        <dt></dt>
        <dd><input type="submit" value="{xen:phrase upload_attachments}" accesskey="s" class="button primary" /></dd>
    </dl>

    <input type="hidden" name="_xfToken" value="{$visitor.csrf_token_page}" />
    <input type="hidden" name="hash" value="{$hash}" />
    <input type="hidden" name="content_type" value="{$contentType}" />
    <input type="hidden" name="key" value="{$key}" />
    
    <xen:foreach loop="$contentData" key="$dataKey" value="$dataValue">
        <input type="hidden" name="content_data[{$dataKey}]" value="{$dataValue}" />
    </xen:foreach>
</form>